基于OpenVPN Server自建VPN

准备：

准备一台服务器（可以从各种云平台购买），安装CentOS 8系统

安装部署：

1. 安装openvpn服务端、证书生成管理（easy-rsa）、流量转发服务（iptables-service）

   yum install -y openvpn easy-rsa iptables-service

2. 生成服务端证书

   1. 查看已安装的easy-rsa目录

      [root@VM-4-16-centos ~]# rpm -ql easy-rsa
      /usr/share/doc/easy-rsa-3.0.8
      /usr/share/doc/easy-rsa-3.0.8/COPYING.md
      /usr/share/doc/easy-rsa-3.0.8/ChangeLog
      /usr/share/doc/easy-rsa-3.0.8/README.md
      /usr/share/doc/easy-rsa-3.0.8/README.quickstart.md
      /usr/share/doc/easy-rsa-3.0.8/vars.example
      /usr/share/easy-rsa
      /usr/share/easy-rsa/3
      /usr/share/easy-rsa/3.0
      /usr/share/easy-rsa/3.0.8
      /usr/share/easy-rsa/3.0.8/easyrsa
      /usr/share/easy-rsa/3.0.8/openssl-easyrsa.cnf
      /usr/share/easy-rsa/3.0.8/x509-types
      /usr/share/easy-rsa/3.0.8/x509-types/COMMON
      /usr/share/easy-rsa/3.0.8/x509-types/ca
      /usr/share/easy-rsa/3.0.8/x509-types/client
      /usr/share/easy-rsa/3.0.8/x509-types/code-signing
      /usr/share/easy-rsa/3.0.8/x509-types/email
      /usr/share/easy-rsa/3.0.8/x509-types/kdc
      /usr/share/easy-rsa/3.0.8/x509-types/server
      /usr/share/easy-rsa/3.0.8/x509-types/serverClient
      /usr/share/licenses/easy-rsa-3.0.8
      /usr/share/licenses/easy-rsa-3.0.8/gpl-2.0.txt

   2. 复制一份easy-rsa到/etc/openvpn目录下

      [root@VM-4-16-centos ~]# cp -r /usr/share/easy-rsa/ /etc/openvpn/easy-rsa

   3. 复制easy-rsa配置文件到/etc/openvpn/easy-rsa/3.0.8目录下,并重命名为vars

      [root@VM-4-16-centos ~]# cp -r /usr/share/doc/easy-rsa-3.0.8/vars.example /etc/openvpn/easy-rsa/3.0.8/vars

   4. 修改证书配置文件vars,主要是修改个人信息,其他的默认就好,也可以不改

      [root@VM-4-16-centos ~]# vim /etc/openvpn/easy-rsa/3.0.8/vars
      # 国家
      set_var EASYRSA_REQ_COUNTRY "CN"
      # 省份
      set_var EASYRSA_REQ_PROVINCE "SICHUAN"
      # 城市
      set_var EASYRSA_REQ_CITY "CHENGDU"
      # 组织
      set_var EASYRSA_REQ_ORG "geren"
      # 邮箱
      set_var EASYRSA_REQ_EMAIL "407906638@qq.com"
      # 组织单位
      set_var EASYRSA_REQ_OU "tpc"

   5. 从头开始创建证书

      1. 启动新PKI

         [root@VM-4-16-centos ~]# cd /etc/openvpn/easy-rsa/3.0.8
         [root@VM-4-16-centos 3.0.8]# ./easyrsa init-pki

      2. 创建根证书